Detection

PaperForthcoming. Table 3 and the detection priorities.

The paper’s chain is threat, then component, then risk, then what can be observed, then where to detect. The matrix is that chain, one cell at a time.

PaperForthcoming. Table 3 and the detection priorities.

Detection is split. The satellite does lightweight checks close to the event. The ground does heavier analysis and correlates events from more than one component.

PaperForthcoming. Table 3 and the detection priorities.

Onboard examples in the paper: command-sequence checks, firmware integrity, abnormal bus activity, and basic system state.

PaperForthcoming. Table 3 and the detection priorities.

Ground examples: machine-learning classification, long-term behavior, and correlation. The paper does not claim these have been evaluated.

PaperForthcoming. Table 3 and the detection priorities.

The same threat can need a different check on a different component. Spoofing on the RF or GNSS side is a signal problem. Spoofing on the telecommand link is a command-sequence problem.

PaperForthcoming. Table 3 and the detection priorities.

Components with several high relationships get more attention. The paper does not prescribe an algorithm.

PaperForthcoming. Table 3 and the detection priorities.

The ratings are qualitative. The paper says they have not been validated in orbit or with controlled attack experiments.

PaperForthcoming. Table 3 and the detection priorities.

The paper tracks lifecycle from design through manufacturing, testing, transport, commissioning, operation, and decommissioning. The heatmap does not assign a stage to each cell.

TalkNot in the paper.

The talk uses cFS and NOS3 so simulated telemetry follows flight-software execution, not a generic network trace.

TalkNot in the paper.

The cFS software bus is treated as one observation point for telemetry, commands, and events, instead of instrumenting every application.

TalkNot in the paper.

Attack scenarios in the talk are grounded in SPARTA, including supply-chain and update attacks: modified packages, configuration, or logic that shows up only under some conditions.

TalkNot in the paper.

Algorithm classes named for onboard execution: EWMA, Kalman filters, SAX, low-state hidden Markov models, isolation forests, autoencoders, and incremental PCA. The talk does not report that one of them won.

TalkNot in the paper.

The talk says a feasibility check used ESA OPS-SAT telemetry: three magnetometer channels, six photodiode channels, eighteen features.

TalkNot in the paper.

The talk discusses a GomSpace Zynq-7000: ARM Cortex-A9 plus FPGA, limited compute, memory, and power. That is why the algorithms have to stay light.